Skip to content

fix: add webhook mutation audit trail and stop logging full pod labels #184

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
miyunari merged 1 commit into from
Sep 20, 2026
Merged

fix: add webhook mutation audit trail and stop logging full pod labels #184

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 15 additions & 11 deletions internal/webhooks/pod_webhook.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -93,31 +93,29 @@
return admission.Allowed("namespace ignored")
}

logger.Info("Checking pod labels", "labels", pod.Labels)
logger.Info("Checking pod labels", "matchLabel", pod.Labels[constants.ModelValidationLabel])
modelValidationName, ok := pod.Labels[constants.ModelValidationLabel]
if !ok || modelValidationName == "" {
logger.Info("ModelValidation label not found or empty, skipping injection")
return admission.Allowed("no ModelValidation label found, no action needed")
}
logger.Info("ModelValidation label found, proceeding with injection", "modelValidationName", modelValidationName)

logger.Info("Search associated Model Validation CR", "pod", pod.Name, "namespace", pod.Namespace,
"modelValidationName", modelValidationName)
mv := &v1alpha1.ModelValidation{}
err := p.client.Get(ctx, client.ObjectKey{Name: modelValidationName, Namespace: pod.Namespace}, mv)
if err != nil {
msg := fmt.Sprintf("failed to get the ModelValidation CR %s/%s", pod.Namespace, modelValidationName)
logger.Error(err, msg)
logger.Error(err, "failed to get ModelValidation CR", "namespace", pod.Namespace, "modelValidation", modelValidationName)

Check failure on line 106 in internal/webhooks/pod_webhook.go

View workflow job for this annotation

GitHub Actions / Run Linting 

The line is 123 characters long, which exceeds the maximum of 120 characters. (lll)
return admission.Errored(http.StatusBadRequest, err) // Fail deployment if CR not found
}
// NOTE: check if validation sidecar is already injected. Then no action needed.
for _, c := range pod.Spec.InitContainers {
if c.Name == constants.ModelValidationInitContainerName {
logger.V(1).Info("Validation init container already exists, skipping", "pod", pod.Name, "namespace", req.Namespace)
return admission.Allowed("validation exists, no action needed")
}
}
for _, c := range pod.Spec.Containers {
if c.Name == constants.ModelValidationSidecarContainerName {
logger.V(1).Info("Validation sidecar already exists, skipping", "pod", pod.Name, "namespace", req.Namespace)
return admission.Allowed("validation exists, no action needed")
}
}
Expand Down Expand Up @@ -165,8 +163,18 @@
pp.Spec.Containers = append(pp.Spec.Containers, sidecar)
}

logger.Info("Injected validation container",
"pod", pod.Name,
"namespace", req.Namespace,
"modelValidation", modelValidationName,
"authMethod", mv.GetAuthMethod(),
"continuous", continuousEnabled,
"legacySidecar", useLegacySidecar,
)

marshaledPod, err := json.Marshal(pp)
if err != nil {
logger.Error(err, "failed to marshal mutated pod")
return admission.Errored(http.StatusInternalServerError, err)
}

Expand Down Expand Up @@ -355,32 +363,28 @@
}

func validationConfigToArgs(logger logr.Logger, cfg v1alpha1.ValidationConfig, model v1alpha1.Model) []string {
logger.Info("construct args")
res := []string{}
if cfg.SigstoreConfig != nil {
logger.Info("found sigstore config")
res = append(res,
"sigstore",
fmt.Sprintf("--signature=%s", model.SignaturePath),
"--identity", cfg.SigstoreConfig.CertificateIdentity,
"--identity_provider", cfg.SigstoreConfig.CertificateOidcIssuer,
)
} else if cfg.PublicKeyConfig != nil {
logger.Info("found public-key config")
res = append(res,
"key",
fmt.Sprintf("--signature=%s", model.SignaturePath),
"--public_key", cfg.PublicKeyConfig.KeyPath,
)
} else if cfg.PkiConfig != nil {
logger.Info("found pki config")
res = append(res,
"certificate",
fmt.Sprintf("--signature=%s", model.SignaturePath),
"--certificate_chain", cfg.PkiConfig.CertificateAuthority,
)
} else {
logger.Info("missing validation config")
logger.Error(nil, "missing validation config")
return []string{}
}

Expand Down
Loading